emotet | f883e2c37de87b0c1250cc03c735233556105fdd3058e52408b4a0bf34d428ab

Analysis

Target
emotet_exe_e5_f883e2c37de87b0c1250cc03c735233556105fdd3058e52408b4a0bf34d428ab_2022-03-17__180550.dll
Size 904KB
Sample220317-wprc1adfe4
SHA256 f883e2c37de87b0c1250cc03c735233556105fdd3058e52408b4a0bf34d428ab
MD5 743f1823097a2ce32732e2d5da355364
SHA1 6b4cdd1de13c7d9542725e18ca121d85bfb0cfbf
SHA512 773aad45570fc9f7b91aee8e61eaabc6e9a6d96e1219b727d01d0f1946ed7e9acb9f636c5f7cbc171790ec1818b9d29f57ca5241f94ab897d24616b68376c86f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet4 2 IoCs

resource	yara_rule
behavioral2/memory/3452-134-0x0000000002390000-0x00000000023B7000-memory.dmp	Emotet4
behavioral2/memory/1528-138-0x0000000002600000-0x0000000002627000-memory.dmp	Emotet4

Loads dropped DLL 1 IoCs

pid	Process
1528	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zsnkdqchhvtchsg\smihhfztw.olc	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1528	regsvr32.exe
1528	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3452	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 3452	2620	regsvr32.exe	82
PID 2620 wrote to memory of 3452	2620	regsvr32.exe	82
PID 2620 wrote to memory of 3452	2620	regsvr32.exe	82
PID 3452 wrote to memory of 1528	3452	regsvr32.exe	88
PID 3452 wrote to memory of 1528	3452	regsvr32.exe	88
PID 3452 wrote to memory of 1528	3452	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f883e2c37de87b0c1250cc03c735233556105fdd3058e52408b4a0bf34d428ab_2022-03-17__180550.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f883e2c37de87b0c1250cc03c735233556105fdd3058e52408b4a0bf34d428ab_2022-03-17__180550.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Zsnkdqchhvtchsg\smihhfztw.olc"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1528

memory/1528-138-0x0000000002600000-0x0000000002627000-memory.dmp

Download

memory/3452-134-0x0000000002390000-0x00000000023B7000-memory.dmp

Download